Re: Strange error log: NAS restarted

2010-01-06 Thread Alan DeKok
Dinh Pham Cong wrote: Thanks, I already created a file named radutmp but I still see no message there. The message Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) appears again and again. Does it mean that NAS server restarted continuously or it is just rlm_radutmp

Re: Radiusd process exited without notice

2010-01-06 Thread Alan Buxey
Hi, Correct me if I am wrong. to what are your clients connected to - eg a cisco LWAPP/CAPWAP wireless network? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Radiusd process exited without notice

2010-01-06 Thread Alan DeKok
Dinh Pham Cong wrote: As I read from http://www.faqs.org/rfcs/rfc2139.html, when Acct-Session-Time is zero, user who is associated with such a session has no service: The latest RADIUS accounting RFC is 2866. And it contains *no* text about the Acct-Session-Time being zero. + The

Re: Strange error log: NAS restarted

2010-01-06 Thread Dinh Pham Cong
Thanks Alan, I have just been confirmed with our telco that one of their GGSN devices would be out of service soon so they blocked the packets coming from our Radius server. Therefore, while they continue to send accounting packets to us, they refuse to receive responses. Regards, Dinh On Wed,

Re: Radiusd process exited without notice

2010-01-06 Thread Bjørn Mork
Alan DeKok al...@deployingradius.com writes: Dinh Pham Cong wrote: or user just establishes network connection and stop it right after that The Acct-Session-Time should be at least 1 second. Why? I can't find any such requirements in RFC 2866. If the session lasts less than .5

Re: Radiusd process exited without notice

2010-01-06 Thread Alan DeKok
Bjørn Mork wrote: Alan DeKok al...@deployingradius.com writes: The Acct-Session-Time should be at least 1 second. Why? I can't find any such requirements in RFC 2866. The RFC's miss a *lot*. It is permissible for a multi-homed NAS to send an accounting start from one IP, update from

Re: Radiusd process exited without notice

2010-01-06 Thread Craig Campbell
/list/users.html __ Information from ESET Smart Security, version of virus signature database 4748 (20100106) __ The message was checked by ESET Smart Security. http://www.eset.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Calling-Station-Id

2010-01-06 Thread osmany
On Tue, 05 Jan 2010 20:05:07 -0500, mic...@casa.co.cu wrote: Osmany osm...@oc.quimefa.cu escribió: Hi, I have Freeradius configured using a mysql backend. I want users to be able to connect only if their Calling-Station-Id is the same as the attribute I specify in the radcheck table in

Re: Calling-Station-Id

2010-01-06 Thread Michel Bulgado
osm...@oc.quimefa.cu wrote: On Tue, 05 Jan 2010 20:05:07 -0500, mic...@casa.co.cu wrote: Osmany osm...@oc.quimefa.cu escribió: Hi, I have Freeradius configured using a mysql backend. I want users to be able to connect only if their Calling-Station-Id is the same as the attribute I

Re: Calling-Station-Id

2010-01-06 Thread Osmany
I tried with the above configuration by putting the number 7 in front of the phone number and indeed the user test can only connect with that phone number. I guess that the NAS forwards the phone number including area code. Since that is working, now I want to add another phone

Re: Calling-Station-Id

2010-01-06 Thread Bjørn Mork
Osmany osm...@oc.quimefa.cu writes: If you would like this test user connect from another phone number, simply add another entry in the same table, just as you did before. Add another entry with the Calling-Station-Id attribute? Let's see if I understand. After I add the other entry in

Re: Calling-Station-Id

2010-01-06 Thread Osmany
On Wed, 2010-01-06 at 17:05 +0100, Bjørn Mork wrote: Osmany osm...@oc.quimefa.cu writes: If you would like this test user connect from another phone number, simply add another entry in the same table, just as you did before. Add another entry with the Calling-Station-Id attribute?

Re: freeradius proxy with 802.1x termination

2010-01-06 Thread John Gammons
After doing some more digging, I think I am catching onto this... somewhat. It sounds like I need to have the Radius Proxy, authenticate the Outer Identity of the EAP-TTLS session locally, while the Inner Identity is proxied to the Home Radius server. I have setup the Outer identity to be

Re: Managing the RADIUS database

2010-01-06 Thread Steve Bertrand
Alan DeKok wrote: Steve Bertrand wrote: The radacct table in the RADIUS database grows at an enormously fast rate. Regardless of server resources, trying to search or perform actions on this table can be a daunting task. Yup. In some cases, people are required to keep this data for

Re: Managing the RADIUS database

2010-01-06 Thread Alexander Clouter
Steve Bertrand st...@ibctech.ca wrote: The radacct table in the RADIUS database grows at an enormously fast rate. Regardless of server resources, trying to search or perform actions on this table can be a daunting task. Yup. In some cases, people are required to keep this data for

Re: freeradius proxy with 802.1x termination

2010-01-06 Thread Alan Buxey
Hi, After doing some more digging, I think I am catching onto this... somewhat. It sounds like I need to have the Radius Proxy, authenticate the Outer Identity of the EAP-TTLS session locally, while the Inner Identity is proxied to the Home Radius server. I have setup the Outer identity

Re: Managing the RADIUS database

2010-01-06 Thread Alan Buxey
Hi, I guess I am a 'small cheese' with only 2m rows in my authentication table? I am using PgSQL and have btree'd my timestamp columns, but it still takes only 3.6s to pull 10k rows worth of just todays data. ah..you have the immediate advantage of postgreSQL I thought the point of

Multiple Realms per NAS

2010-01-06 Thread Nalin Mistry
We have just installed FreeRADIUS and have basic functionality working for ISP and Hotspot applications. For the ISP application, we would like to specify the realms supported on a NAS basis. Is this feasible and how would one go about configuring it. Thanks in advance... - List

Re: freeradius proxy with 802.1x termination

2010-01-06 Thread Alan DeKok
John Gammons wrote: After doing some more digging, I think I am catching onto this... somewhat. It sounds like I need to have the Radius Proxy, authenticate the Outer Identity of the EAP-TTLS session locally, while the Inner Identity is proxied to the Home Radius server. Yes. I have

Re: Managing the RADIUS database

2010-01-06 Thread Alan DeKok
Steve Bertrand wrote: Considering that the project objective and purpose is designed around FreeRADIUS and it's SQL database, and really doesn't have much use elsewhere. Leverage the FreeRADIUS name. :) Net::FreeRADIUS::Management ? I'd say Net::RADIUS::Management. Design the

Re: Multiple Realms per NAS

2010-01-06 Thread Arran Cudbard-Bell
On 1/6/2010 12:13 PM, Nalin Mistry wrote: We have just installed FreeRADIUS and have basic functionality working for ISP and Hotspot applications. For the ISP application, we would like to specify the realms supported on a NAS basis. Is this feasible and how would one go about configuring

Re: Managing the RADIUS database

2010-01-06 Thread Alexander Clouter
Alan Buxey a.l.m.bu...@lboro.ac.uk wrote: I guess I am a 'small cheese' with only 2m rows in my authentication table? I am using PgSQL and have btree'd my timestamp columns, but it still takes only 3.6s to pull 10k rows worth of just todays data. ah..you have the immediate advantage of

Re: Managing the RADIUS database

2010-01-06 Thread Steve Bertrand
Alan DeKok wrote: Steve Bertrand wrote: Considering that the project objective and purpose is designed around FreeRADIUS and it's SQL database, and really doesn't have much use elsewhere. Leverage the FreeRADIUS name. :) Net::FreeRADIUS::Management ? I'd say Net::RADIUS::Management.

Re: Calling-Station-Id

2010-01-06 Thread Michel Bulgado
Osmany wrote: I tried with the above configuration by putting the number 7 in front of the phone number and indeed the user test can only connect with that phone number. I guess that the NAS forwards the phone number including area code. Since that is working, now I want to add